gomorat | dl7uh30ydg3gl13j[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
dl7uh30ydg3gl13j.exe
Size 915KB
Sample261027-vvhsdatt4j
SHA256 2e315fd446210b544a6b0ce4aa58c67001a83d53a45718334de92c57bc9c1053
MD5 95547fe5efec2033806026f9ff047607
SHA1 7fc18f7ee309c6562f75055431a4877ada4a6ccf
SHA512 8656d7dd1cf73ea904cffc621430b7b8a6c0a289acef89f74fe77e8b9d85cc127240a46b875de797db85e662f582d2cfc5732c06384c741e399e94281206e8ec
SSDEEP 12288:v28IG99n+u3KjSh+2ddQgi4s/WKbNQi7o/fQVUKPkbNIs5EM9PoeOH2hW:+8Xr+UhV+zgzZC2W
TLSH
T1B615F86A7B828F09E065687DCCCD3322D7A51FF32333634B3B086714168A5CA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
unhicazz92a5s6t2pf2djq3z
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
yisz1ohra53ofiexn5ud21uns
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
5d106xkm6zeiilsv9cjz
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
dl7uh30ydg3gl13j.exe

File Explorer

dl7uh30ydg3gl13j.exe

.exe 915KB

dl7uh30ydg3gl13j.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2e315fd446210b544a6b0ce4aa58c67001a83d53a45718334de92c57bc9c1053
MD5 95547fe5efec2033806026f9ff047607
SHA1 7fc18f7ee309c6562f75055431a4877ada4a6ccf
SHA512 8656d7dd1cf73ea904cffc621430b7b8a6c0a289acef89f74fe77e8b9d85cc127240a46b875de797db85e662f582d2cfc5732c06384c741e399e94281206e8ec
SSDEEP 12288:v28IG99n+u3KjSh+2ddQgi4s/WKbNQi7o/fQVUKPkbNIs5EM9PoeOH2hW:+8Xr+UhV+zgzZC2W
TLSH
T1B615F86A7B828F09E065687DCCCD3322D7A51FF32333634B3B086714168A5CA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

dc:21:b5:0e:9d:ec:e9:05:1c:c1:e5:8b:a6:59:ab:be:7a:52:85:0a:aa:38:78:9a:4e:07:47:f9:ba:9b:5e:b1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 16, 2023

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 19, 2021 - Aug 18, 2024

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

930206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dl7uh30ydg3gl13j.exe

PE Signature issue

mscoree

dotnet